SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,479 copies16 likes159,606 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the usage of COM objects that can be abused to download files within PowerShell scripts by identifying specific CLSIDs. This technique is often used by adversaries for ingress tool transfer or to establish command and control.
Detects the usage of the 'Get-AdComputer' PowerShell cmdlet to enumerate computer objects or their properties within Active Directory. This activity is often performed during the discovery phase of an attack to map out the network environment.
Detects the usage of the "Add-AppxPackage" or its alias "Add-AppPackage" with the "-AllowUnsigned" flag to install unsigned AppX packages. This can be used by adversaries for persistence or defense evasion by installing malicious applications that bypass signature checks.
Detects various obfuscated PowerShell IEX (Invoke-Expression) invocations generated by the Invoke-Obfuscation framework. The rule specifically looks for patterns used by Invoke-Obfuscation to construct the 'IEX' string using character manipulation from PowerShell built-in variables like $PSHome, $ShellId, $env:Public, and $env:ComSpec, as well as other obfuscation techniques like `*mdr*).Name` and `$VerbosePreference.ToString(`.
This rule detects obfuscated PowerShell execution launched via rundll32.exe. It specifically looks for PowerShell script block text containing 'rundll32.exe', 'shell32.dll', 'shellexec_rundll', and 'powershell', which are indicators of the Invoke-Obfuscation framework's RUNDLL LAUNCHER technique. This method is often used for defense evasion and execution of malicious scripts.
Detects obfuscated PowerShell scripts that utilize rundll32.exe, shell32.dll, and shellexec_rundll to execute commands. The rule specifically looks for the presence of '&&', 'rundll32', 'shell32.dll', 'shellexec_rundll' along with keywords like 'value', 'invoke', 'comspec', or 'iex' within PowerShell script block logs. This combination is indicative of techniques used for defense evasion and execution.
Detects PowerShell scripts that read file content, iterate through it, and perform DNS host lookups, potentially for data exfiltration or reconnaissance. This combination of actions is suspicious as it suggests an attempt to process local data and resolve external network information.
This rule detects the use of the PowerShell cmdlet `New-PSDrive` to map a new drive to a remote Windows administrative share (e.g., C$, ADMIN$). This activity is often associated with lateral movement by adversaries who use valid credentials to interact with remote systems over Server Message Block (SMB). The rule specifically looks for the `New-PSDrive` cmdlet, the `-psprovider filesystem` argument, the `-root` argument, and the presence of a UNC path (`\\`) ending with a dollar sign (`$`), which is characteristic of administrative shares.
Detects the use of the PowerShell 'Write-EventLog' cmdlet in conjunction with the '-RawData' flag. This combination can be exploited by adversaries to embed malicious payloads within Windows Event Logs, which can then be retrieved later. This technique is often employed for defense evasion, allowing attackers to conceal their activities within seemingly legitimate system logs. Detection relies on PowerShell Script Block Logging being enabled.
Detects attempts to remove or modify Windows Defender configurations using the 'Remove-MpPreference' PowerShell cmdlet, specifically targeting settings like Controlled Folder Access and Attack Surface Reduction rules. This activity is indicative of an adversary trying to impair defensive capabilities.
Page 576 of 680